About · Ghost in the Machine
Transparent checks, an open-weight guardian
PhantomShield AI combines transparent cybersecurity checks with an open-weight AI assistant to make security education easier to understand.
Why open innovation matters here
- Every rule behind the scanners is readable source: you can see exactly why a link or message was flagged.
- An open-weight model can be swapped for another compatible one without changing the product.
- The project is not permanently tied to a single proprietary model provider.
- The deterministic checks keep working when the AI service is unavailable or unconfigured.
- Password evaluation runs entirely in the browser, so it never depends on a remote service at all.
How a request moves
1 · Your browser
Scores the link or message with local rules. Never opens the link, never stores the password.
2 · App server
Holds the system instructions and the provider key, screens harmful requests, and trims the payload to findings.
3 · Model provider
Generates the explanation. It receives text only and cannot change a calculated score.
There is no account system and no database in this build. Nothing you submit is stored on a server.
Model configuration
Read live from the server's configuration for this deployment.
- Active mode
- Managed gateway (no key configured)
- Inference provider
- Base44 AI gateway (managed)
- Model name
- platform default
- Endpoint
- managed by Base44
To run your own open-weight model, add an app secret named HUGGINGFACE_API_KEY holding an inference-provider token. It stays on the server and is never included in the page.
The model is selected with PHANTOMSHIELD_AI_MODEL (default google/gemma-2-2b-it) and the endpoint with PHANTOMSHIELD_AI_BASE_URL (default https://router.huggingface.co/v1). Any OpenAI-compatible chat-completions endpoint works, so Gemma, Llama, Qwen, or a self-hosted server can all be used.
No open-weight key is set, so the assistant currently uses Base44's managed model gateway and is labelled that way. It is not an open-weight deployment controlled by this project, and the platform bills those calls as AI credits. The rule-based scanners and the password checker never depend on it.
Stays in your browser
- Password strength analysis and its common-password list.
- The URL and message rule engines, including scoring.
- Rule-based explanations and recommended steps.
- Scan history, lesson progress, and quiz scores (browser storage only).
Sent to a server, only on request
- Messages you type into the AI assistant, when you send them.
- The scanner's findings and score, when you press “Explain with AI”.
- That is all: no password, no full message, no attached file is ever sent for an AI explanation.
AI requests are not local processing: they leave this app and are handled by the configured inference provider under its own terms. Passwords are never part of them.
Source repository
Repository link not configured yet.
Add an app secret named PHANTOMSHIELD_REPO_URL with your GitHub URL after publishing, and the link appears here. No repository is claimed until you set it.
No licence is asserted on this page. Add the licence you actually use in the repository before publishing it.
Responsible use
This is an educational tool. A low risk score is not proof that a link, message, or sender is safe, and a high score is not proof of fraud — both are estimates from visible text. Nothing here checks reputation, DNS, page content, attachments, or live threat intelligence. For money already lost, a compromised device, or an active intrusion, contact your bank, your employer's IT team, or a professional.
The assistant will not help with attacking people or systems. That refusal is enforced on the server before any model is called.